CVE-2025-0973: Cmseasy Path Traversal Vulnerability

CVE-2025-0973 Overview

CVE-2025-0973 is a path traversal vulnerability [CWE-22] affecting CmsEasy version 7.7.7.9. The flaw resides in the backAll_action function within the lib/admin/database_admin.php library. Attackers can manipulate the select[] argument in requests to /index.php?case=database&act=backAll&admin_dir=admin&site=default to traverse directories outside the intended scope. The attack requires network access and low-privileged authentication. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against unpatched installations. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated attackers can traverse the file system through the database backup function, potentially exposing sensitive files and altering integrity or availability of the CmsEasy installation.

Affected Products

CmsEasy 7.7.7.9
CmsEasy lib/admin/database_admin.php component
Installations exposing /index.php?case=database&act=backAll to authenticated users

Discovery Timeline

2025-02-03 - CVE-2025-0973 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0973

Vulnerability Analysis

The vulnerability exists in the backAll_action function of CmsEasy's database administration library. This function processes the select[] request parameter, which the application uses to determine which database tables or files to include in a backup operation. The parameter is passed into file operations without sufficient normalization or validation. As a result, attackers can inject ../ sequences or absolute path components to reference files outside the intended backup directory. The flaw is reachable through the admin interface endpoint /index.php?case=database&act=backAll&admin_dir=admin&site=default, which requires an authenticated session with backup privileges.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The backAll_action handler trusts user-controlled entries from the select[] array and concatenates them into file system paths. No canonicalization or whitelist filtering constrains the input to expected table names or files inside the backup directory.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the vulnerable endpoint with malicious select[] values containing traversal sequences. The application then reads or manipulates files at attacker-chosen locations during the backup workflow. Because the endpoint is remotely reachable, exploitation does not require local access. The public disclosure of technical details on GitHub lowers the barrier for weaponization.

See the GitHub proof-of-concept writeup and VulDB entry #294364 for reproduction details.

Detection Methods for CVE-2025-0973

Indicators of Compromise

HTTP requests to /index.php?case=database&act=backAll containing select[] parameters with ../, ..\, URL-encoded traversal sequences (%2e%2e%2f), or absolute paths.
Unexpected file reads from CmsEasy processes touching directories outside the application's backup path.
New or modified files in the backup output directory referencing system paths or configuration files.

Detection Strategies

Inspect web server access logs for administrative requests to the database case with abnormal select[] array contents.
Deploy a Web Application Firewall (WAF) rule that blocks path traversal patterns in query and body parameters targeting the CmsEasy admin endpoint.
Correlate PHP file access events with the parent HTTP request to identify traversal attempts reaching disk operations.

Monitoring Recommendations

Alert on authenticated admin sessions issuing backup requests from unfamiliar source addresses or user agents.
Monitor file integrity for CmsEasy directories and adjacent system paths accessible to the web server user.
Track outbound transfers of backup archives that exceed typical size baselines, which may indicate exfiltration of files pulled through traversal.

How to Mitigate CVE-2025-0973

Immediate Actions Required

Restrict access to the CmsEasy admin interface using IP allowlists, VPN gating, or reverse proxy authentication.
Rotate credentials for all CmsEasy administrator accounts and enforce strong password policies.
Audit backup output directories and web-accessible paths for signs of unauthorized file reads or writes.
Disable the database backup feature until a vendor patch is available if the function is not operationally required.

Patch Information

No vendor patch is currently referenced in the CVE record. The vendor did not respond to disclosure attempts according to the VulDB submission. Monitor the CmsEasy project channels for a fixed release and apply it as soon as it is published.

Workarounds

Deploy WAF rules that reject requests to the backup endpoint containing traversal characters or non-whitelisted select[] values.
Enforce filesystem-level controls so the web server user cannot read files outside the CmsEasy application root.
Remove or rename the admin_dir to a non-default value and require additional authentication layers in front of it.
Consider migrating to an actively maintained CMS if upstream support remains unresponsive.

bash

# Example nginx rule to block traversal patterns against the vulnerable endpoint
location ~* /index\.php {
    if ($args ~* "case=database.*act=backAll") {
        set $block_traversal 1;
    }
    if ($request_body ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        set $block_traversal "${block_traversal}1";
    }
    if ($block_traversal = 11) {
        return 403;
    }
}